Attempt to Deactivate an Okta Network Zone

  1[metadata]
  2creation_date = "2020/11/06"
  3integration = ["okta"]
  4maturity = "production"
  5updated_date = "2026/04/10"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to
 11a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta
 12network zone in order to remove or weaken an organization's security controls.
 13"""
 14false_positives = [
 15    """
 16    Consider adding exceptions to this rule to filter false positives if your organization's Okta network zones are
 17    regularly modified.
 18    """,
 19]
 20index = ["filebeat-*", "logs-okta*"]
 21language = "kuery"
 22license = "Elastic License v2"
 23name = "Attempt to Deactivate an Okta Network Zone"
 24note = """## Triage and analysis
 25
 26### Investigating Attempt to Deactivate an Okta Network Zone
 27
 28The Okta network zones can be configured to restrict or limit access to a network based on IP addresses or geolocations. Deactivating a network zone in Okta may remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.
 29
 30#### Possible investigation steps
 31
 32- Identify the actor related to the alert by reviewing the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
 33- Examine the `event.action` field to confirm the deactivation of a network zone.
 34- Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the network zone that was deactivated.
 35- Investigate the `event.time` field to understand when the event happened.
 36- Review the actor's activities before and after the event to understand the context of this event.
 37
 38### False positive analysis
 39
 40- Check the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's normal behavior, it might be a false positive.
 41- Check if the actor is a known administrator or part of the IT team who might have a legitimate reason to deactivate a network zone.
 42- Verify the actor's actions with any known planned changes or maintenance activities.
 43
 44### Response and remediation
 45
 46- If unauthorized access or actions are confirmed, immediately lock the affected actor account and require a password change.
 47- Re-enable the deactivated network zone if it was deactivated without authorization.
 48- Review and update the privileges of the actor who initiated the deactivation.
 49- Check the security policies and procedures to identify any gaps and update them as necessary.
 50- Implement additional monitoring and logging of Okta events to improve visibility of user actions.
 51- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.
 52
 53## Setup
 54
 55The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 56references = [
 57    "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
 58    "https://developer.okta.com/docs/reference/api/system-log/",
 59    "https://developer.okta.com/docs/reference/api/event-types/",
 60    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
 61    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
 62    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
 63]
 64risk_score = 47
 65rule_id = "8a5c1e5f-ad63-481e-b53a-ef959230f7f1"
 66severity = "medium"
 67tags = [
 68    "Use Case: Identity and Access Audit",
 69    "Data Source: Okta",
 70    "Use Case: Network Security Monitoring",
 71    "Tactic: Defense Evasion",
 72    "Resources: Investigation Guide",
 73]
 74timestamp_override = "event.ingested"
 75type = "query"
 76
 77query = '''
 78data_stream.dataset:okta.system and event.action:zone.deactivate
 79'''
 80
 81
 82[[rule.threat]]
 83framework = "MITRE ATT&CK"
 84
 85[[rule.threat.technique]]
 86id = "T1484"
 87name = "Domain or Tenant Policy Modification"
 88reference = "https://attack.mitre.org/techniques/T1484/"
 89
 90[[rule.threat.technique.subtechnique]]
 91id = "T1484.002"
 92name = "Trust Modification"
 93reference = "https://attack.mitre.org/techniques/T1484/002/"
 94
 95[[rule.threat.technique]]
 96id = "T1562"
 97name = "Impair Defenses"
 98reference = "https://attack.mitre.org/techniques/T1562/"
 99
100[[rule.threat.technique.subtechnique]]
101id = "T1562.007"
102name = "Disable or Modify Cloud Firewall"
103reference = "https://attack.mitre.org/techniques/T1562/007/"
104
105[rule.threat.tactic]
106id = "TA0005"
107name = "Defense Evasion"
108reference = "https://attack.mitre.org/tactics/TA0005/"